Application Serial Number: 10/644,841 

Amendments to the Claims 

This listing of claims replaces prior versions: 

Claims 1-94 (canceled) 

Claim 95 (new): A protection system for a computerized device, the system 
comprising: 

a monitoring and capturing sub- system configured to monitor activities relating to 
storage devices and communication peripherals and to detect and to act against suspicious or 
dangerous activity; and 

an encrypted database storing default security rules including default rules, pre- 
distribution rules, additionally- acquired user-defined rules, and statistics of acceptable 
program behavior continuously learned during system operation; 

wherein accesses to the encrypted database is tracked by the monitoring and capturing 
sub- system. 

Claim 96 (new): The system of claim 95, wherein the encrypted database further 
stores a log of security questions presented to users and replies thereto. 

Claim 97 (new): The system of claim 95, wherein the encrypted database further 
stores a log of detected suspicious activities. 

Claim 98 (new): A method of monitoring, checking and authorizing access to hooked 
functions that are called due to a memory-related action, the method comprising: 
retrieving the identity of the entity calling the hooked function; 
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retrieving related information from a database; 

receiving the hooked function's parts and self-allocated memory; 

checking if memory limits are exceeded; and 

passing parameters to the original hooked function if the memory limits are not 
exceeded. 

Claim 99 (new): The method of claim 98, wherein, if the memory limits are exceeded, 
the method further comprises: 

requesting permission from a user as a condition to passing parameters to the original 
hooked function. 

Claim 100 (new): The method of claim 98, wherein, if the memory limits are 
exceeded, the method further comprises: 

terminating a process that called the hooked function. 

Claim 101 (new): The method of claim 98, wherein, if the memory limits are 
exceeded, the method further comprises: 

falsely indicating that a request that called the hooked function has been completed. 
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